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This listing of claims will replace all prior versions, and listings, of claims in the application. 

1 . (Original) A method of reducing spread of data on a network, comprising: 

obtaining a spectral analysis of times of arrival of data packets at receiving nodes 
of said network from sending nodes of said network over predetermined time periods; 

for each pair of sending node and receiving node, marking transmissions of data 
packets for said pair as marked transmissions when said spectral analysis indicates peak 
frequencies associated with said marked transmissions are different from peak frequencies 
associated with others of said transmissions for said pair over a window of a predetermined 
number of said time periods; 

marking transmissions of data packets as interruptible transmissions when 
marked transmissions from pairs having at least one of a common sending node and a common 
receiving node and within a specified number of said windows have corresponding frequencies; 

estimating timing and length information for future data packets corresponding 
to said interruptible transmissions; and 

interrupting traffic of said future data packets based on said estimating. 

2. (Original) The method of claim 1, wherein obtaining a spectral analysis comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into said windows; and 
obtaining Lomb periodograms for said windows. 

3. (Original) The method of claim 1, wherein estimating comprises applying a Hidden 
Markov Model technique for classifying said interruptible transmissions as belonging to one of 
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a plurality of classes of transmissions having determinable characteristics. 

4. (Original) The method of claim 1, wherein interrupting comprises randomly removing data 
packets. 

5. (Original) The method of claim 4, comprising: 

interrupting for a specified time; and 

determining, after said specified time, if a further spectral analysis of times of 
arrival of data packets since beginning said interrupting indicates said peak frequencies 
associated with said marked transmissions. 

6. (Original) The method of claim 5, comprising returning to estimating based on said further 
spectral analysis when said further spectral analysis indicates said peak frequencies associated 
with said marked transmissions. 

7. (Original) The method of claim 4, wherein obtaining a spectral analysis comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into said windows; and 
obtaining Lomb periodograms for said windows. 

8. (Original) A method of reducing spread of data on a network, comprising: 

obtaining, at a receiver node of said network, periodograms based on times of 
arrival of data packets from a sender node of said network; 

comparing peak frequencies in successive ones of said periodograms for said 
sender node to determine if one of said periodograms includes a peak above a threshold at a 
frequency different from said peak frequencies in a preceding one of said periodograms; 

determining if at least one peak above said threshold at said frequency occurs in 
one of a predetermined number of previous periodograms for said sender node; 
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determining if said at least one peak at said frequency occurs in at least one of a 

specified number of periodograms obtained at said receiver node for other sender nodes of said 

network; 

estimating timing and length information for future data packets corresponding 
to said frequency when said at least one peak at said frequency does not occur in one of said 
predetermined number of previous periodograms for said sender node and when said at least 
one peak at said frequency occurs in at least one of said specified number of periodograms 
obtained at said receiver node for other sender nodes of said network; and 

interrupting traffic of said future data packets corresponding to said frequency 
based on said estimating. 

9. (Original) The method of claim 8, wherein obtaining said periodograms comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 

10. (Original) The method of claim 8, wherein said estimating comprises classifying a data 
stream for said at least one peak at said frequency based on said periodograms using a Hidden 
Markov Model. 

1 1 . (Original) The method of claim 8, wherein interrupting comprises: 

randomly removing data packets for a specified time; 

determining, after said specified time, if said at least one peak at said frequency 
occurs in at least one additional periodogram based on times of arrival of data packets since 
beginning said interrupting; and 

returning to estimating based on including said additional periodograms with 
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said specified number of periodograms when said at least one peak at said frequency occurs in 

said at least one additional periodogram. 

12. (Original) A method of reducing spread of data on a network, comprising: 

obtaining, at a router node of said network, periodograms based on times of 
arrival of data packets from a sender node of said network; 

comparing successive periodograms for said sender node to determine when at 
least one new peak above a threshold is present in one of said periodograms; 

determining if said at least one new peak occurs in one of a predetermined 
number of previous periodograms for said sender node; 

determining if said at least one new peak occurs in at least one of a specified 
number of periodograms obtained at said router node for other sender nodes of said network; 

estimating timing and length information for future data packets corresponding 
to said at least one new peak when said at least one new peak does not occur in one of a 
predetermined number of previous periodograms for said sender node and when said at least 
one new peak occurs in at least one of said specified number of periodograms obtained at said 
router node for other sender nodes of said network; and 

interrupting traffic of said data packets corresponding to said at least one new 
peak based on said estimating. 

13. (Original) The method of claim 12, wherein interrupting comprises randomly removing 
data packets for a specified time. 

14. (Original) The method of claim 1 3, wherein obtaining said periodograms comprises: 

tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
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obtaining Lomb periodograms for said windows. 

15. (Original) The method of claim 14, wherein said estimating comprises classifying a data 
stream for said at least one new peak based on said periodograms using a Hidden Markov 
Model. 

16. (Withdrawn) A method of classifying disruptive data packet traffic flow on a network, 
comprising: 

obtaining at a router, periodograms based on times of arrival of said data packets 
from nodes of said network; 

comparing successive periodograms for each of said nodes to determine when at 
least one new peak above a threshold is present in one of said periodograms for one of said 
nodes; 

marking said at least one new peak as a suspicious peak when said at least one 
new peak does not occur in one of a predetermined number of previous periodograms for said 
one of said nodes; 

determining if said suspicious peak occurs in at least one of a specified number 
of periodograms obtained at said router for others of said nodes of said network; 

determining if said suspicious peak occurs in at least one of said specified 
number of periodograms obtained at other routers for said one of said nodes; and 

providing a signal to classify traffic flow corresponding to said suspicious peak 
as disruptive traffic flow when said suspicious peak occurs at least in at least one of said 
specified number of periodograms obtained at said router for said others of said nodes and in at 
least one of said specified number of periodograms obtained at said other routers for said one of 
said nodes. 

17. (Withdrawn) A computer-readable medium containing instructions for controlling a 
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processor to classify disruptive data packet traffic flow, by: 

obtaining at a router, periodograms based on times of arrival of said data packets 
from nodes of said network; 

comparing successive periodograms for each of said nodes to determine when at 
least one new peak above a threshold is present in one of said periodograms for one of said 
nodes; 

marking said at least one new peak as a suspicious peak when said at least one 
new peak does not occur in one of a predetermined number of previous periodograms for said 
one of said nodes; 

determining if said suspicious peak occurs in at least one of a specified number 
of periodograms obtained at said router for others of said nodes of said network; 

determining if said suspicious peak occurs in at least one of said specified 
number of periodograms obtained at other routers for said one of said nodes; and 

providing a signal to classify traffic flow corresponding to said suspicious peak 
as disruptive traffic flow when said suspicious peak occurs at least in at least one of said 
specified number of periodograms obtained at said router for said others of said nodes and in at 
least one of said specified number of periodograms obtained at said other routers for said one of 
said nodes. 

18. (Withdrawn) The computer-readable medium of claim 17, further containing instructions 
for controlling said processor to obtain said periodograms, by: 
tracking times of arrival data; 

transforming said times of arrival data into time-series; 
parsing said time-series into windows; and 
obtaining Lomb periodograms for said windows. 
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19. (Withdrawn) The computer-readable medium of claim 17, further containing instructions 

for controlling said processor to provide a signal to classify traffic flow using a Hidden Markov 
Model. 

20. (Withdrawn) The computer-readable medium of claim 17, further containing instructions 
for controlling said processor to interrupt, by: 

randomly removing data packets for a specified time; 

determining, after said specified time, if said at least one peak at said frequency 
occurs in at least one additional periodogram based on times of arrival of data packets since 
beginning said interrupting; and 

returning to estimating based on including said additional periodograms with 
said specified number of periodograms when said at least one peak at said frequency occurs in 
said at least one additional periodogram. 

21 . (Original) A computer program, disposed on a computer-readable medium, for reducing 
spread of data on a network, said computer program including instructions for causing a 
processor to: 

obtain a spectral analysis of times of arrival of data packets at receiving nodes of 
said network from sending nodes of said network over predetermined time periods; 

for each pair of sending node and receiving node, mark transmissions of data 
packets for said pair as marked transmissions when said spectral analysis indicates peak 
frequencies associated with said marked transmissions are different from peak frequencies 
associated with others of said transmissions for said pair over a window of a predetermined 
number of said time periods; 

mark transmissions of data packets as interruptible transmissions when marked 
transmissions from pairs having at least one of a common sending node and a common 
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receiving node and within a specified number of said windows have corresponding frequencies; 

estimate timing and length information for future data packets corresponding to 
said interruptible transmissions; and 

interrupt traffic of said future data packets based on said estimating. 

22. (Original) The computer program of claim 21, wherein said instructions to obtain a 
spectral analysis comprise instructions to: 

track times of arrival data; 

transform said times of arrival data into time-series; 
parse said time-series into said windows; and 
obtain Lomb periodograms for said windows. 

23. (Original) The computer program of claim 21, wherein said instructions to estimate 
comprise instructions to apply a Hidden Markov Model technique to classify said interruptible 
transmissions as belonging to one of a plurality of classes of transmissions having determinable 
characteristics. 

24. (Original) The computer program of claim 21, wherein said instructions to interrupt 
comprise instructions to randomly remove data packets. 

25. (Original) The computer program of claim 24, wherein said instructions to interrupt 
further comprise instructions to: 

interrupt for a specified time; and 

determine, after said specified time, if a further spectral analysis of times of 
arrival of data packets since beginning to interrupt indicates said peak frequencies associated 
with said marked transmissions. 

26. (Original) The computer program of claim 25, wherein said instructions to interrupt 
further comprise instructions to repeat said instructions to estimate based on said further 
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spectral analysis when said further spectral analysis indicates said peak frequencies associated 
with said marked transmissions. 
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